My application, without this fix, had already created other media + cards for the same promotable user successfully in other campaigns (and for other promotable users in other campaigns as well). I’m still not sure how that’s possible since none of those calls contained additional owners or as_user_id.

The additional_owners requirement is for all media, regardless of where it’s used. You’re right that we should make that clearer. We’ll start by clarifying that additional_owners is required when the media will be used by a user other than the authenticated user in the media/upload documentation.

In terms of your second note, we fixed a bug where this requirement was not being respected on card creation.

After some more testing I see that passing as_user_id when creating website cards (my point 1 above) is not required for the request to succeed. What is required is the additional_owners param when uploading media. Thanks again @juanshishido for providing clarity.